Extracted

• • Target

    38ac6284a88ccb4ee40212a22c2575bb90f719c6dad952c23a286759f1108c80

  • Size

    3.4MB

  • MD5

    aa460dc0cf6a357b45f66e9f7ef535c1

  • SHA1

    fa4130f40cff7890b1773beec8fdc9132b76c69d

  • SHA256

    38ac6284a88ccb4ee40212a22c2575bb90f719c6dad952c23a286759f1108c80

  • SHA512

    bd403d094fb9f2b72cc254e9db2d2c841d0e46fe19334bba139d53c4087001d3d0e5ab716b86076710f592abe9f18ae4413a10eaa46c828242ccf16107bf0073

  • SSDEEP

    98304:nmN2t+apaCv1Y6nyTsigAJ2FT8zd/oV2V:mN2gANrny7jJHh/q2V

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Detects BitRAT RAT

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2